4-Attachment D TechnicalCriteria VictimInformationSystem.docx

Attachment D: Technical Criteria Statewide Victim-Centered Information System

Section 1 – Minimum Mandatory Requirements All Mandatory Minimum Criteria must be met for an Offeror’s technical submission to be evaluated.

1. System Continuity, Victim Verification, and Program Growth: The offeror must meet all requirements for victim notification system and have capacity for expansion of services to potentially include two or more of: (1) end-to-end case management capabilities that carry through the entire system(including access to case management notes, case information, contact information, and a complete history of the case's progression), (2) Victim/Offender Dialog management, (3) Grant Reports, and (4) Publications/Training Library.

2. Data Protection & No Commodification: The offeror must certify they will never mine, share, transfer, or use the data for any private or commercial purpose without explicit written authorization from the State of Utah.

3. Mitigation of Vulnerable Information Release: The offeror must certify they have programming safeguards to mitigate any release of vulnerable information and provide notification of data leakage or breaches and remediation protocols.

Section 2 - Technical Criteria If an Offeror can demonstrate that they meet all Section 1 requirements, their submission will be reviewed for technical criteria requirements

1. Trauma-Informed and Victim-Centered Communication Offeror must demonstrate ability to provide a user experience that prioritizes the victim's emotional and physical safety, giving them personalized control over how they receive information.

· Clear and Understandable Notifications: Notifications must clearly explain what is occurring, why it is occurring, and who to contact for support.

· Granular Victim Control: Victims must have total control over when and how they receive notifications, including the ability to select only necessary alerts and opt out of others (e.g., choosing to skip notifications for routine transfers from a jail to a prison). Multiple notification options (text, email, phone, app, secure portal) must be available to and controlled by the user and can be updated as the victim’s needs change.

· Blackout Date & Quick Exit Functionality: The system must allow victims to select "blackout dates" (contact-free days) to pause non-emergency notifications, as well as feature a "Quick Exit" button for immediate safety, allowing victims to instantly close the page.

· Language & Support: The system must provide multilingual message translation (98% accuracy) and allow victim advocates to assist with proxy registration.

· Child-to-Adult Life Cycle Handling: The system must handle cases where a victim was a child at the time of the offense and has since become an adult, including secure processes for transitioning or revoking previous parental access.

2. System Continuity, Victim Verification, and Program Growth Offeror must demonstrate ability to provide a seamless, unified experience for the victim across all jurisdictions, while equipping advocates with robust tracking tools and allowing for additional phases to grow services available to victims.

· Single Unified Account: Victims must only need one account with one login and to be able to attach multiple offenders to their profile, providing continuity of access to information regardless of which agency is involved.

· Authorized User Verification: The system must feature a secure way to verify a victim’s identity and for that verification to carry throughout all points of the system.

· Additional Phases for Growth in Services: The system must have capacity for future expansion in providing services to potentially include (1) end-to-end case management capabilities that carry through the entire system (including access to case management notes, case information, contact information, and a complete history of the case's progression), (2) Victim/Offender Dialog management, (3) Grant Reports, (4) Publications/Training Library, etc.

· Centralized Victim Impact Statements: The system must include a feature that allows victims to submit a Victim Impact Statement once and make it securely available across different stages and agencies of the criminal justice process. The system must allow the victim to update or modify the statement as desired over time and reflect the time and date of any changes.

3. Seamless Integration and Accessibility (Compliance) Offeror must demonstrate technical capability of the system to securely communicate with existing state infrastructure in near-real-time without losing functionality.

· Stakeholder Integration: The system must integrate directly with existing systems, including Jail and Correctional Management Systems, Offender Management Systems, Court Management Systems, and the Board of Pardons and Parole (BOPP).

· Global Information Synchronization: Updating information with one agency must automatically update or make that information available to all other integrated agencies in near-real-time.

· Accessibility and Compliance: The system will need to provide comprehensive language access services, including, but not limited to translating documents and digital content into required languages with a minimum accuracy standard of 98%, and formatting all translated documents into accessible digital formats (e.g., Word, PDF, HTML) that meet WCAG accessibility standards.

· Single Sign-On: The system must integrate with the State’s UtahID single sign-on platform, including multi-factor authentication.

· Dashboard: The system must include a simple mobile app for survivors featuring a dashboard that shows offender/defendant custody status and court dates.

4. Strict Data Ownership, Privacy, and Security Offeror must demonstrate commitment to protecting sensitive victim information and ensuring the State of Utah retains absolute control over its data.

· Exclusive Agency Ownership: All data is "owned" by the governmental entity that created, prepared, maintained, or owned the record and that the governmental entity retains control over how the data is used.

· Data Protection & No Commodification: The offeror must certify they will never mine, share, transfer, or use the data for any private or commercial purpose without explicit written state authorization.

· Mitigation of Vulnerable Information Release: The system must have safeguards and be able to mitigate any release of vulnerable information through programming to prevent local counties from accidentally transmitting sealed cases, juvenile cases, civil cases, or expunged cases into the public access. The system must provide notification of data leakage or breaches and remediation protocols.

· Compliance Certifications: The system must adhere to the State of Utah's IT Terms and Conditions, ensure top-tier data security and accessibility for all users, and demonstrate full compliance with GovRAMP certification requirements (similar to FedRAMP/FISMA cloud security standards). The system must seamlessly integrate with existing systems utilizing modern APIs and web services. Additionally Criminal Justice Information Services (CJIS) compliance

· Victim/User Confidentiality Protections: The system must provide strong privacy protections blocking users from searching for victims. Search options must only be available for incarcerated persons. Victim information should only be used for the notifications for which they sign up.

5. Timeline & Logistics Offeror must provide:

· Timeline: Detailed project timeline specifying phases for integration, testing, and go-live (e.g., initial rollout phase followed by legacy system conversions).

· Support & Maintenance: Detailed Service Level Agreements (SLAs), including response times for technical issues, system updates, and 24/7 call center support.